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Managing a Vulnerability Testing 
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What This Talk is Based On 
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Some Background 
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Defining Objectives for Management 
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Describe the Approach 

Define the scope - not a “Big Brother” activity 
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Describe the Methodology 

Identify a set target vulnerabilities placing networked 
systems at risk; 
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Describe the Methodology com 

Set a window for corrective actions to be completed; 
Repeat scans to ensure corrective actions were taken 1 
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Return on Investment (ROI) 
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Return on Investment (ROI) 

• Review impacts to the company from a 
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Informing the Community 


>> iz 

5 -8 


E 

E 

o 

o 

0 


Q_ 

0 


0 
CO 
0 
c 
0 s 


CD 5 

■E I 

0 

8 -® 

TD 01 

LU 1 



0 


0 

E 

ro 

O 

O) 


0 

o 


o 

a 

-*— * 

QL 

0 

"O 

CO 

c 

_c 

0 

* * 

-4— > 
0 

0 

L_ 

0 

0 

H 

“D 

h— » 

C 

3 

— 

>> 


-4— < 

0 

’c 

l_ 

0 

c 

3 

E 

3 

E 

> 

o 


o 

0 

0 




-4— > 

C 

*0 

0 

t_ 

3 

Q_ 

0 

X 

C 

LU 

LU 



E 

"D 

< 




TD 

0 

CO 

3 

O) 

c 

0 

X) 

JO 

o 

o 

0 


0 

_Q 

'u_ 

o 

CO 

0 

Q 


CO 

c 

0 


O 

0 

o 

0 

-4— ' 


0 

M— 


0 


0 


L_ 

o 

£ 

M— 

05 

0 

c 

o 

‘c 

o 

-4— < 

‘0 

L_ 

0 

-4— ' 

r~ 

0 

-4— ' 

■O 

1 

> 

o 

o 

CL 


i i i 




©If appropriate, Insert your organization’s copyright 

information 




Informing the Community 


c 

o 

o 


0 

_Q 


£ 

0 

^ CO 

co 

0 3 
O 0 
0 0 

0 O) 

E .j= 

0 00 
r- 0 


0 


0 


O) 


£ > 
— 0 
0 o 
0 


£ .2 o3 
3 o ^ 
CO CO O 
0 m ^ 
•- S> <D 
0 « TO 
£ O 0 

- £ E 

a o ® 

O O -Q 
W O) = 
co >*.E $ 

O o CO (0 

O- co t: £ 

*“ CD 

_0 — CO 

CL ^ 0 

C > o 

CO ro § 

E 2 ffl 

0 -= 5" 


0 


CO 

^ c 

5 § 4 = 

6 §1 

CO Q 0 


O) 

•E 

0 

Q_ 

0 ^ 

0 0 

£ E 

c 0 

.E o) 

_0 0 

&! 

LU E 

1 



©If appropriate, Insert your organization’s copyright 

information 



Scheduling Events 


co 


E 

33 <0 

co .2 

E fc 

0 Q. 

5 ^ O) 
^ a 
CO ~ 

CD w 
£ 0 ) 

"p! 

±3 CD 

> CD 

> Q. 

fc 
0 O 


u 

ID 
D) 0 

if 

0 V* 

L. 

CD 0 


0 CO 
"O CD 
"O 
o CD 

CO O) 

0 Q. 


CO Q_ 

Q. _TT 


O g 
0 E 
.0 0 
v* O) 

■E 0 

o c 


c 0 
0 o 


0 


I I 


0 ° 

~ >» 

1! 

1 TD 


co 5 o 

-t— ’ > ^ 

c ^ -S 

0 O 0 

O (/) Z 


Conference 

i Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 





■8 

» 

0 

0 ) 

0 

_Q 


CO 


JO 

o 

o 

0 


0 © 
^ CO 


0 


0 


"O 

0 

_> 

o 

> 


0 

o 

0 

i— 

0 


0 c 
0 c 

0 "O 

£ 2 

1 I 

0 .£ 


0 ^ 

E -o 
c c 

=3 0 

I i 
8 £ 
<D CO 
£ 0 


0 

0 
• wmmm 

m mmm 

> 

m Mm 

o 

0 

o 

0 

c 

0 


0 0 


0 ■“ 
O) > 

2 D) 


0 

E 

0 

c 

0 


0 

0 

0 

0 


C 0 

J= co 

0 ■— 


0 


0 0 

t r (D 


+* ~u 

$ 8 

< o 








C/3 


CO 

CO 

c 

■ MMH 

■O 

c 


o 

CO 

o 

■ MMB 

■ Mi 

r~ 

CO 

2 

o 

c 

CD 


o5 

Q. 

t 

■O 

Q) 

CO 

■ HMM 


0) 

Id 

cl 

> 

• 

• 

• 




Conference .. . 

^ Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 





0 

i_ 

o 

4— ' 

CD 

4 — » 

CO 

■ w 

c 

E 

"D 

< 

D) ^ 
<D 2 


i_ CD 

i E 

CL 0 

« ^,-D 

O CO ® 

=§ 0 C 

8 CO CD 
£ O O 
~ r co 


O) 

© 

.0 

co 

E 

0 

'4— * 

> 

0 


c tr 


D) ~ 


0 

0 

o 

_Q. 

0 

0 

0 "S 

TD F 


0 

0 


® 0 
< E 


> c 

O 0 

o 

Q- co 

i 


0 

“O 

*0 

0 
0 

1 

o 

0 

0 

0 

o 

U 

ID 

c 

o 

O 


0 

0 


j*: 

0 


a) 5 

0 "O 

E £ 

0 o 

0 

0 _£ 


0 .t=; 

S <: 

0 ^ 


0 

E 

0 

D) 

0 


O 

E 
o 

•4^ 

0 h= 

E | 

0 

0 TD 
'*-* > 
S E 

h- a. 


i 


i 




Conference - r , 

i Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 




Test Preparations 




©If appropriate, Insert your organization’s copyright 

information 





05 


c 

o 

o 

</> 

c 

.2 -o 


CD 

.Q 


CO 

CO 

Q. 

O 

£ 


(/> 

Q) 


CO 

"55 

0) 

o 

13 

■D 

C 

o 

O 


0 

CD 

O 


CO 

“D 


CO 

0 

“O 

co 


_co 

L— 

0 


0 

75 

0 



u 

0 


£ 

0 

- 4 — • 

D 


■ M^B 

'll 

O 

u 


-+-* 

C 

“D 

"D 


0 

c 

C 

J 


E 

r~ 

SI 


0 

0 

0 


O) 

n 

_Q 


0 

CO 

0 

0 

c 

0 

E 

E 

E 

0 

0 

CD 


•+— » 
0 

- 4 — » 
0 


0 

> 

>> 

0 

0 

0 

0 

O 

T3 

0 BB 

- 4 — > 

- 4 — » 

o 

> 

0 

0 

i- 

o 

0 

0 

C 


h“ 

H 

0 

Q. 



©If appropriate, Insert your organization’s copyright 

Information 



Reporting Test Results 






CO 

.C O) 
CO .E 
= co 


03 

00 

LU 


o 

o 

6 






©If appropriate, Insert your organization’s copyright 

information 



Monitoring the Test 


o> £ 

i o> 

0 

O _Q 

C C/) 
CO 0 
0 0 
O 0 


0 o 


I I 


O) 43 

c 0 
— 0 
0 

-Q 0 
| 1-0 

3 0 0 

0,0 0 
>, 0-0 

CO I 



C^- 

o- 

"O 

c 

0 

o 

to 

1^3 

0) 

0 


CL 


E 

to 

o 


o 

o 

o 

0 

c 

0 


0 



O) 

■ MB 

c 

GO 

0 

0 

O 

w *~ > 

0 

0 

Q. 

c~ 



0 

TD 

_c 

Q 


• 

• 


©If appropriate, Insert your organization’s copyright 

information 



Validate and Analyzing the Results 


2 1q 
o ro 

2 ® 
c > 

E "o 


<0 

CO 


0 0 
■c > 


CO ^ 

0 p 


II 

Q- < 


co 

0 0 

c 

E ^ 

0 § 

0 o 
Q co 



©If appropriate, Insert your organization’s copyright 

information 



c 

o 


o 

CD 


<1) 

O) 

CD 0 

-4— < 

c 
0 
o 


a> 


c 


"S 

0 

(/) 


(0 


CD 

0 

o 

(0 

CL 

r~ 

■4— » 

</) 

■ ■H 

o 


0 

n 

CO CO 

(0 

co .52 



00 

m 5 

LU 

0 -z: 

Q_ CD 


E a) 


O E 


o ^ 


0 > 


£ 0 


0 

Q. 

0 


0 

0 


3 

"O 


0 

O 


> O 
CD H 


o 

0 

L. 

L_ 

o 

o 


. 0 

>» 

Q 0 

4— » 

o 


= 0 

■m = 
P 0 


0 

_C 

3 

> 

Id 

o 

4 — • 
0 
-t— « 

O) 


0 

0 

i_ 

Q_ 

0 


£ 

.0 


O CO 


0 

0 


0 0 
0 


0 

_Q 

E 


CD 


CO 

O 

CL 


3 

o 

0 

CO 

o 

c 

2 

_Q 


CO 

0 


0 

o> 

0 

c 

0 

O 

i_ 

0 

Q. 

0 

>* 

.Q 

0 

0 


JD 

0 

i__ 

0 

_C 

3 

> 

Id 

o 

•4— > 
0 


0 

c 

0 

E 

c 

0 

0 

0 

x v i_ 

0 -o 

£=5 

« £ 
0) T3 

D) 

Lc <o 

0 


0 

_Q 


0 = 

P 

-c 2 

0 0 

Q- C 

® 3 

T3 > 


= 0)0 


o 

0 
-4— > 

o 


o <0 

3 r 


O LU 0 

' ' m 


to 


"O 

0 


0 

O 

o 

I 


0 

iz 0 

0 


0 

O 

O 


0 

_Q 

E 

LU 

I 




i Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 



Establish a Baseline 


c 

o 

o 



©If appropriate, Insert your organization’s copyright 

information 



Choosing a Report Format 


C^- 

CO 

0 




■r* 

CO 

0 
■ MH 

Q. 


CO 

CO 

CO 



e- 

0 

o 


0 



0 

0 

05 

CO 


O 

>* 

CO 



o- 

tl 

0 



O 

0 







©If appropriate, Insert your organization’s copyright 

information 




c^- 

CD 

> 

0 


CO 

CL 

E 

8 'v 

2 P 

0 <5 

S S 

O) ^ 
C 

ft MMftft 

o _ 

03 0 

i: > 

■t: 

03 


CD 

E 


Q_ 

E 


o •- 


03 


CO 


> => 

45 0 


CO 


03 

N 

C 

03 

C3) 


O 

"cT 

E 

D) 

C 

ft 

o 

03 


03 

O 

CC c/j 

> = 

45 0 


CO 

to 

0 

-4—* 

0 

D 

O 

*> 

0 

i_ 

Q. 

E 

o 


£ 

o 


0 

o 

O) 

0 

O) 

0 

0 


0 ~ 

0 5 

.2 0 

O 5 

0 .2 

5 0 
£ n 
c c 
0 0 

e e> 

0 o 

° 1 
0 


CL 

E 


0 
Q_ 

E 

o 

</) O 


l 


I 





Vulnerabilities Metric Status 



c 

o 

IH 

(0 

N 

■ HI 

c 

(0 

O) 

b. 

O 

> 

n 

</> 

<D 


■ ^■1 
n 

cs 

k_ 

<D 

C 


3 

> 


(0 

*-» 

o 

h- 



</)</></) 
0) a> 0) 

i= != 

is 

5 2 2 
0) <u 0 
c c c 

3 D D 

>>> 

<0.2 * 

gw 

00 COO) 

O) 0)0) 
0)0)0) 

j *-• o .Q 

O <D <1) 
O Q Ll 

B B □ 


saj)j|jqejdU|nA jo jaquinN 



i Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 




Vulnerabilities Metric Status 



©If appropriate, Insert your organization’s copyright 

information 





Presenting the Results to 



£ 

0 

E 

0 

O) 

0 

£ 

CO 



E 

0 ) 

2 

Q. 

CD 

CD 


CD 


CO 


o 

- 4 — ' 

CO 


_co 

CO 

0 

O) _ 

1 » 

O) 

p CO 

Q. £ 

£ GO 

£ o 


co 

0 ) 

GO 

CO 


CO 

0 


£ ^ 

I -D 
0 

0 O 

fc & 
O * 

3 O) g 


o 

vu 

> 


O) 

c 

■ 

O) 


0 


0 


0 

c 

o 

0 

■D 

o 

CO 

E 

T3 

C 

■ 

■ 

£ 

o 

V w 

Q. 

E 

■ HM 

$ 

o 

3 

CT 

Q. 

o 

•4— » 

E 


O 


c 


CO 

0 

CO 

o 

0 

£ 

O 
■ <■■■■■ 

£ 

0 

0 

t 

0 

tr 

0 

0 

o 

"O 



■ MM 


c~ 

r~ 

■ 

o 

1 

m 

O 

O 

o 

CO 

• 


• 

• 

• 

• 

• 1 



i Expo /2001 ©If appropriate, Insert your organization’s copyright 

information 




Achieving Compliance 




CO 


0 


U) 

E 

0 

c 

o 

0 

o 


CO 

0 

0 

TD 


~o 

■ MM 

E 

o 

0 


CL 

O 

H 


0 

"c6 

.Q 

■D 

CD 

X 


O O CD 
§ 0- 


©If appropriate, Insert your organization’s copyright 

information 




Work from the Bottom 


i- O 

/IN 1 CO 

CD CO 0 

~ I c 

0 CD CD 
D : u 

CD 

o £ cl 

^ O x 

CL X 0 


^ £ 

0 M “ 

CO CO 0 

CD O 0 

c O 
■g tl 03 

n -t= o. 

a u co 

ire 

w O) 
*5 T3 .£ 

0 c >- 

1 CD 00 


> Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 



Work the Middle Managers 


“O 

CD 

O) CO 


0 

T) CO 

C 0 

u o 


6 9 

r~ 0 


$ £ 
E T3 

a 

2 -c 

co o 

0 CO 
£ O) 

o vi 
■^3 o 
co •£ 

c -Q 

0 “O 
CO c 

2 co 

O) 

0 .E 

TO 0 
O) Q) 

5 E 

*- Q. 

4e 0 

It: 0 

o * 

1 I 


0 

E 

n 

p 0 

0 Q_ 

m 0 
0 "O 

co *5 

O) _0) 

C Q. 

:e g 

.c o 

CO CD O 

O « i 

*->(/> o. 

CD co c 

0 < .E 
6 1 



i Expo/2001 ©If appropriate, Insert your organization’s copyright 

Information 



Q. 

O 

0 

o 

3 

o 

o 

0 


L_ 

Q. 

0 
• mmmm 


0 

E 

"ro 

0 


O) 

0 

■o 

CD 

c: 

0 

X 

o 

■ HMI 

>* 

C 

0 

CD 

CO 


r~ 

CL 

» MMi 


cc 

O 

«4—» 

O) 


S' ^ J= 
^ S o 

off*. 

>» 0 -C 

0 -5) 
0)0) — I 

o O Q. 

t* r; ° 
>■* ^ 
to j- rn 
to co 

0 -C - 

— — 0 


CO 
CO 

0 _ 
0 CO 


Ql 

O u j 

yy yy 


o yj 
=j yy 


o 

0 


0 

E 


0 


4—1 

4-j 

«♦— » 

c 

ff) 

0 

C 

c 

0 

o 

V// 

O) 

c 

0 

o 

<1) 

E 

0) 

0 

E 

0 

E 

> 

• wmmm 

0 

N 

M— 

0 

■ 

0 

xa 

> 

o 

L_ 

> 

o 

L_ 

o 

1— 

CL 

■ OTM 

C 

0 

_Q 

0 

Q. 

E 

Q. 

E 

E 

D) 

0 

X 




O 

X 

E 

£ 

nP 

0 s 

0 s 

O 

_d 

0 

0 

0 

C 

o 

O 

O 

o 

*0 

s_ 

CO 

o 

O) 

O 

O 

» 

0 

0 

_0 

o 

o 

w_ 

Np 

0 s 

vP 

cr 

0 

X 

0 

0 

O 

O 

X 

D) 

0 

N 

CO 

O) 

0 

0 

— 




c 

cn 


1 

1 

1 

LU 

• 

• 




• 


0 

o 

0 


0 

0 


0 

_Q 

O 

0 

C 

0 

£ 

0 

c 

o 

o 




i Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 



Example “Stop Liaht Chart 



S^Sooi ©If appropriate, Insert your organization’s copyright 

information 

























Lessons Learned and Pitfalls 



CO 


o 

o 








to 

c 

E 

0 

E 

I - 

o 

0 

O 

£ 

0 

O) 

£ 

c 

■ 

o 

o> 

"D 

■ mmmm 

E 

C 

o 

o 


O 

c 

• 

• 




< Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 





j/> 

o 

o 

H 



2 s 

Q. ^ 


13 

Jr CO 

i -2 

> O 
T3 

C Jr 
03 O 

0 

p = 

E co 

c TJ 

— CO J- 

C0 .2 .2 

E 2 

w © -t= 

i_ CO 
CO a) c 

ill 
* ^3 

c >» o 

C CD 5 

S| 0 

w Ez 


CD 


CD 


~o 

CD 


^ E 


CD o 
(f) ~o >*> 


03 

O) 


0 

0) 

L. 

0 
-*— » 

>* 

-Q 

CO 
CO 
0 
O 
O 

0.-2 

0) ■= 
C .0 
+3 CO 
CO Jr 
CD 0 
^ C 

0 0 

£ > 

0.0 

■O © 
0 -Q 

© E 

G- 13 
CO C 


r- O) 

II 

3 0 

o o 
>* 0 

0 1 
0 _c 
0 o 

$ I 

0 _Q 

>. ^ 

a> o 

$ | 

■4— » z: 

0 CD 


0 


0 


0 

> 


Q. 

0 

~o 


3 % 

j. f 

o © 

.c £ 

■0 0 




O 3 © 

05 TO CO 
C 0 C 

£ m E 




i Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 





o 

o 


03 


03 


« 0) 
y o 


03 

> 

“O 

03 


c n -= 


Q 

03 


CO 

0 

> 

b 


03 


C/3 0 

E 2: 

■ mamm 

E 

■D 

< 

E 

0) 

> 0 
> 
0 


"O 

c 

CO 

03 


C/5 

0 


O 

5 

> w 

d 0 

0 0 

0 Q. 


0 

O 

.o 


0 ® 
"O -3 


0 

0 

05 


05 

05 

O 


0. CL 

I I 


0 

E £ 

0 o 

■s ° 
>> 

0 o 

0 J2 

co 0 

Q. h= 

0 — 
L • — 

0 


05 


0 

0 


o 

> 


o 

o 


$ 

o 

"co 

o 

0 

0 

-Q 

0 

v_ 

0 


E 

~o £ 

0 

2 0 

1 


0 

E 

■ 

0 


0 

«2 c 
£ 0 
C 

O 0 

E 0 

CM -Q 

£*•9 

O w 

0 O 

■ 

=s o 

O CD 
•8 © 

g'-g 

*= a) 

C/3 t 

0 O 
O 




i Expo/2001 appropriate, Insert your organization’s copyright 

information 




Inform the Community 





©If appropriate, Insert your organization’s copyright 

information 



Inform the Community 


CO 0 
I? CO 


jl) 

2 CO 

g o 

Cl) CO 
D) 

c « 

CO c 
O 


£3 

2 £ 
3 ^ 
CO CO 

c >. 

LU CO 


i Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 




a> 

E 

a> 

G) 

<0 

c 

CO 



o 

U) 


c 

a> 

(/) 

a> 

£ 


CO 

o 




o 

c 


o 

CO 


o 

CD 


c 

.Q 


0 

]D 


> 

13 



O 



CO 


33 



c 


o 

CD 

E 


0 

*> 

CD 



O) 


0 

CO 



c 

03 


6 

E 


s 

o 


D) 

■ BHB 



i 

n 


Q. 

o 

Q. 

£ 

O 

0 

0 

CO 


B 

£ 

SB 

0 

0 

0 

B 

> 

B MBBBB 

Li. 

o 

LL 


0 

E 

o 

o 

o 

CO 

O) 

c 


o 

CT> 

c 

■ MMBi 

c 

co 


0 


0 

E 

ID 

0 

0 

0 


CO 

0 

o 

03 

03 

E 

O) 

c 

CO 


0 

E 

JZ 

o 

0 

0 

> 


o 

O Z 

> 

< 1 


0 

> 

o 

Q. 

E 


0 O) 

- E' 

0 

£ 0 
o o 

k_ 

0 ’T 

g> o 

0 


+-» 0 

O ® 
QL O 
Q_ A3 
=3 0 

0 _Q 

O 


0 

"O 

* MB 
> 
o 


2 D) 

■ HM 

o 

0 




©If appropriate, Insert your organization’s copyright 

information 




A Note About Scan Results 


c o 

03 *■' 

o c 

CO ■— 

— 

£ 0 

t .Q 

O _ 


£ 0 
0 © 



< £ 


i Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 




CO 

<- 0 

E 0 


to E 

0 


■= 0 
-0 0 

0 o 

N 

— 0 


o 5 

8 ) g 

< o 


■g 3 
ro 3 

|c 

0 CO 
CO 

0 c 
CO 0 

S 2 E 


o o 

m' Q- 

§.i 

0 D) 

0 .E 

0 hr 

•1 3 

1 s 

CL E 





> Expo/2001 ©If appropriate, Insert your organization’s copyright 

information 



